GitHub GH-300: Use GitHub Copilot Responsibly Practice Questions

Correct: For GitHub Copilot for Business (and Enterprise), prompts and suggestions are not retained beyond fulfilling the request and are explicitly not used to train the underlying model — a key privacy differentiator from the Individual plan's default settings. | Wrong - Retained for 28 days: This misrepresents the policy; Business/Enterprise plans do not retain snippets for training at all. | Wrong - Retained indefinitely but anonymized: Anonymization is irrelevant here because Business/Enterprise data is not retained for training regardless of anonymization. | Wrong - Only accepted suggestions: This describes a plausible-sounding partial policy, but it is incorrect; Copilot for Business does not retain any prompts or suggestions for training purposes.

Correct - Fairness: Fairness is one of the six core Microsoft Responsible AI principles, requiring that AI systems treat people equitably and minimize bias in outputs. Correct - Reliability and Safety: Also one of the six core principles, it requires that AI behaves predictably, safely, and consistently across conditions. | Wrong - Maximum throughput: Throughput is an engineering performance metric, not a Responsible AI principle; it has no place in ethical AI frameworks. | Wrong - Competitive advantage: Business strategy goals are not Responsible AI principles; responsible AI is about societal benefit and harm prevention, not market competition. | Wrong - Open-source compliance: While openness can be valued, requiring open weights is not part of Microsoft's Responsible AI framework. | Wrong - Vendor lock-in minimization: Portability is a cloud architecture concern, not a Responsible AI principle.

Correct - Duplicate detection: Enabling the public code matching filter is the primary technical control to catch suggestions that closely replicate licensed public code. Correct - Review licenses: GitHub advises developers to treat Copilot suggestions like any third-party code and review applicable licenses before shipping — a key recommended practice. Correct - Trust Center: The GitHub Copilot Trust Center provides official transparency documentation on IP policies, helping legal teams understand GitHub's position and developer obligations. | Wrong - Rely on unit tests: Unit tests verify correctness and behavior, not originality or copyright status; they cannot determine if code is a reproduction of copyrighted material. | Wrong - Content exclusions for IP: Content exclusions prevent private files from influencing context; they are a privacy/security tool, not an IP originality checker for outgoing suggestions. | Wrong - Disable in files with imports: This is an overly broad and unsupported practice; importing third-party packages does not mean Copilot will reproduce their licensed code, and blanket disabling would eliminate legitimate productivity benefits.

Three correct responsible AI behaviors: (F) GitHub does provide opt-out mechanisms for Individual plan users regarding data use for model improvement — this reflects the Privacy principle. (D) The GitHub Copilot Trust Center is a real transparency resource documenting data handling, telemetry, and opt-outs — reflecting Transparency/Accountability. (C) Content filters are applied to reduce harmful or offensive outputs — reflecting Safety and Reliability principles. Option A is incorrect: GitHub explicitly does not guarantee that Copilot suggestions are free of security vulnerabilities; developers are responsible for reviewing suggestions. Option B is incorrect: GitHub explicitly does not certify suggestions as free of IP encumbrances; the duplicate detection filter helps but provides no legal guarantee. Option E is partially correct in listing the principles, but as a blanket statement it conflates listing principles with demonstrating behaviors — and 'accountability' and 'transparency' are also part of Microsoft's Responsible AI framework that GitHub references; the statement is too vague to be a specific demonstrated behavior.

GitHub Copilot for Business commits to: (1) not using prompts or suggestions to train AI models, and (2) transmitting data over TLS and not retaining prompts/suggestions after the response is delivered. Option E is incorrect: GitHub does not provision dedicated per-organization encrypted vaults for source code; this is not a documented commitment. Option D is incorrect: Copilot does not automatically redact PII from suggestions; developers are responsible for avoiding sensitive data in prompts. Option B is partially plausible but is not one of the two most directly documented data-handling commitments specific to how the service processes code — it relates more to contractual arrangements than to technical data handling.